[Rtir] Constituencies in RTIR/custom fields
peter.bates at ucl.ac.uk
Wed Nov 13 11:48:40 EST 2013
-----BEGIN PGP SIGNED MESSAGE-----
On 13/11/2013 16:07, Kevin Falcone wrote:
> Either pre-populate it or change it to a freeform field, although that
> may act weirdly with the built in reporting. Try it and see.
> Tools -> Configuration -> Custom Fields
I'll give this a go - Custom Fields shows that there are two
'Customer' fields, one is 'Select multiple values' (for the IR queue) and the
other is 'Select one value' (for the Investigations queue).
Is it not possible to just have one if I'm going to try
and populate a list?
Apologies for this - I'll read the workflow document again.
The majority of our work here is manual response to IDS alerts
from which we throw an Incident and then into an Investigation.
Senior Information Security Officer Phone: +44(0)2076792049
Information Services Division Internal Ext: 32049
University College London
London WC1E 6BT
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (MingW32)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
-----END PGP SIGNATURE-----
More information about the Rtir